CVE-2022-49854: 
Linux Debian vulnerability analysis and mitigation

A vulnerability in the Linux kernel's Management Component Transport Protocol (MCTP) subsystem was identified and assigned CVE-2022-49854, disclosed on May 1, 2025. The vulnerability affects Linux kernel versions from 5.15 up to 6.1 rc4, specifically impacting the error handling mechanism in the mctp_init() function (NVD).

The vulnerability stems from an improper error handling path in mctpinit() function. When mctpneigh_init() returns an error, the routes resources are not properly released in the error handling path. This implementation flaw has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Wiz).

The vulnerability results in a resource leak in the Linux kernel when the MCTP initialization fails. This can potentially lead to system resource exhaustion, affecting the system's availability (Wiz).

The vulnerability has been fixed in the Linux kernel through a patch that properly releases route resources in the error handling path of mctpinit() when mctpneigh_init() fails. Updates are available for affected systems including Ubuntu 20.04 and 22.04 (Wiz).